ApacheDS (LDAP) Network Accounts Never Can Login

I have been fighting with LDAP via ApacheDS for days attempting to get Mavericks to actually authenticate against the LDAP server.
Here is the path that I have taken:
ApacheDS is setup with simple authentication (disabled everything else for the moment after attempting to login every which way).
Here is an example of the LDAP setup:
dc=example,dc=com
ou=usersuid=username
cn=Full Name
sn=Name
displayName=FullName
userPassword=hash
uid=username
ou=groups
cn=Users
cn=Administrators
Then I went to Users and Groups, Allow network users to login is checked
Joined a Network Account Server
(When looking at edit, it shows a green indicator)
I setup a custom mapping under LDAPv3 which contains:
Seach Base: ou=users,dc=example,dc=com
Users: inetOrgPerson
AuthenticationAuthority: uid
NFSHomeDirectory: #/Users/$uid$
PrimaryGroupID: #20
RealName: cn
RecordName: uid
UniqueID: uid
UserShell: #/bin/bash
I can see the information in the Directory Editor from the LDAP server, Search Policy has the network accounts right after the local accounts.
When attempting to login, it just shakes... Here is the only items that I can see in the opendirectoryd.log:
2014-01-04 10:26:50.785452 CST - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ldap.bundle'
2014-01-04 10:27:06.734300 CST - 22.805 - Client: opendirectoryd, UID: 0, EUID: 0, GID: 0, EGID: 0
2014-01-04 10:27:06.734300 CST - 22.805, Module: ldap - failed to retrieve LDAP server schema - LDAP error - 50
2014-01-04 10:27:07.031977 CST - 22.823.826 - Client: opendirectoryd, UID: 0, EUID: 0, GID: 0, EGID: 0
2014-01-04 10:27:07.031977 CST - 22.823.826, Node: /LDAPv3/example.com, Module: ldap - __odnode_copy_record_block_invoke: 4101 No predicates provided
Anyone have any ideas?

I was able to activate the debug log in the Leopard client machine, but I don't know how to look from another machine via SSH... Could you explain a bit the procedure? Is it possible to try to log in as a network user and then, after failure, log in as an admin account and check the log with Console?
Today I found out that Snow Leopard clients are also not able to log in... Similar problem in Directory Utility:
This is what I found in the log for this machine (tried to log in with two different accounts):
25/04/12 20:09:17          SecurityAgent[321]          User info context values set for XXX
25/04/12 20:09:18          authorizationhost[320]          Failed to authenticate user <XXX> (tDirStatus: -14103).
25/04/12 20:09:25          SecurityAgent[321]          User info context values set for YYY
25/04/12 20:09:25          authorizationhost[320]          Failed to authenticate user <YYY> (tDirStatus: -14103).
Couldn't find much about this in Google.
I'm starting to feel really disappointed about this!
(sorry for the delay in answering, been abroad...)

Similar Messages

Network accounts do not login in

Hi everyone,
last month our Xserve G5 with Leopard Server which controlled user accounts in our computer labs died. We replaced it with a Mac mini server (that includes Lion Server) –by the way, this is the first server that I ever setup–.During initial configuration, the server was fully updated to Lion server 10.7.3, and stablished as an OD Master. I didn't import anything from the old server, so all accounts and groups and preferences and everything have been defined from scratch.
Everything was working good until I finish the setup and try to connect from one of our Leopard client machines. I configure that machine with Directory Utility with settings from the server, and the server responds just fine, the client sets everything up automatically for authentication and contacts. Everything seems to be normal until I log out and try to connect with one of the network accounts.The account will not login, the login window just shakes and does nothing. Odd enough, the login window tells that network accounts are available (captures are in Spanish).
When I login again as a local admin account, I check Directory Utility and when I look at the LDAP configuration, in the search & maps tab of the window, I find these two red registers (UserAuthenticationData and OLCLDIFConfig). I don't know if this is related to the problem, but this is where I get stuck and don't know where else to go...
Any ideas?

I was able to activate the debug log in the Leopard client machine, but I don't know how to look from another machine via SSH... Could you explain a bit the procedure? Is it possible to try to log in as a network user and then, after failure, log in as an admin account and check the log with Console?
Today I found out that Snow Leopard clients are also not able to log in... Similar problem in Directory Utility:
This is what I found in the log for this machine (tried to log in with two different accounts):
25/04/12 20:09:17          SecurityAgent[321]          User info context values set for XXX
25/04/12 20:09:18          authorizationhost[320]          Failed to authenticate user <XXX> (tDirStatus: -14103).
25/04/12 20:09:25          SecurityAgent[321]          User info context values set for YYY
25/04/12 20:09:25          authorizationhost[320]          Failed to authenticate user <YYY> (tDirStatus: -14103).
Couldn't find much about this in Google.
I'm starting to feel really disappointed about this!
(sorry for the delay in answering, been abroad...)

Network accounts freeze at login

I have a lab with a mix of 10.4 and 10.5 machines connected to a leapord server. Thought the day when users login the login screen locks up and users are forced to restart the computer. After they restart the computer they are able to login. The machines are connected to a server that is set to open directory master.

Hi There,
We still have that problem with 10.5 clients only. See my previous post
http://discussions.apple.com/message.jspa?messageID=8613415#8613415
Let me know if you find a fix, i have almost given up o this one.
Kevin

Enabling Fast User Schwitchin for more than 2 network account

Hello,
My Fast User Schwitching is enabled
When I log into an iMac, with a network account, at the right top corner, I can see black personn (icon) from where I see the local Admin account and the netowrk account that I use.
Always from the balck person icon, I can click on Login Window, and then I have the possiblity to log into a third.
But at this time, when I try to be log with the second network account I got that error message :
"Your are unable to log in to the user account this time. Login in to the account failed bevauce an error accured"
But when I log off the first network account, I can log with the any other account.
In resume, only one local account and one network account can be log. Not 2 network account.
Any idea why, and how can I switch between 2 or more network account?
Many thank

Any idea, it will help?

Network account server will be no response after restart.

Hi,
New Imac with Max OS 10.6.4.
Our compan's domain with 2 AD servers(windows 2003 server ), the imac can joined the domain successfully, when the imac restarted, the network account server will show "no responese".
The imac is connected to network successfully, the network account server can be found via ping command.
Any help will be highly apperciated!

The same here. Several times chatting with an skype employee but still not action or they just say, sorry your account is suspended, make a new one.
At this point i'm quite aggitated by this. I even made a new account and within 1 day the account is again f*king suspended. No explination or what so. They keep reffering to fill in their forms with questions while this solves absolutely nothing.
First i was happy with skype. Now with the fusion with Microsoft accounts it work like ....
Hope someone can help me instead of letting me fill on 1000 forms.

Can not login to a network account.

I dont typically support macs, but I have a client with an odd issue that I can not solve.
He has a Macbook Pro with OSX 10.6.
He logs in using his network account, authenticating against an OSX 10.5 server.
When he tries to to login, it appears as if he has a bad password.
His account is able to login just fine on other Macbooks in the company. (So I'm assuming his network account and password are fine)
Other users are able to log into HIS Macbook just fine, inclusing new accounts that have never before logged into this Macbook. (So I assume his macbook is communicating just fine with the OSX server)
When I go into the accounts list in the Macbook, his account is not there. It's missing.
If I try to create an account with his name, I'm told the account already exists.
We ran diskutility to repair the permissions on the drive, but this did not fix the issue.
Any ideas?
On the windows support side I would simply rebuild the users profile.. I'm not sure what the equivilent is on the mac side.

I'm having a similar problem. Could you let me know how to eliminate the mobile account using the command line?
Thanks!

Can't Login With Network Account After Upgrade To Yosemite Server 4

I've been putting off this troubleshooting for a while now, and after trying everything I could find, decided to post.
- After upgrading my server to Yosemite with Server 4, and my MacBook to Yosemite, I can no longer login with any network accounts.
- I was on clean installs of Mavericks before the upgrade.
- I'm using SSL for the OD, with a GoDaddy cert, the same one that was working on Mavericks.
- I've tried removing the laptop's binding using the Users and Groups preferences dialog, which does not remove the laptop's entry from Open Directory, so I manually deleted the record on the server.
- I then choose to Join again, and it looks as though everything goes through, but I still cannot login with a network account. Also, when rejoining, it does not create a binding on the server.
- If I use the Directory Utility->Services->LDAPv3, and add it that way, entering the FQDN and checking Encrypt..., Use for auth and Use for contacts, it asks me for the directory admin username and password, and does in fact create the binding on the server, but I still cannot login. What's strange about that method, is that it forces the use of the IP address of the server, rather than the FQDN, like I entered it, which would of course have problems, because the certificate's common name is the server's FQDN. It does not allow me to change from using the IP address, graying out that field.
- I've also tried destroying the OD and restoring from archive to no avail.
It looks like many users have hit dead ends with this, with some having success by completely formatting and setting up a new iteration of the server, but I will not be doing that. However, I'll be happy to try any other suggestions.
Thanks for your time,
   -- Mike

     Okay, I've finally resolved the issue, thanks to the Apple Enterprise tech support team. I'm thinking they wouldn't mind if I share this information, but I can't guarantee that this will work on your system or, worse yet, degrade your system further. However, that's fairly unlikely, just make sure you have plenty of backups before you begin any troubleshooting session.
     So I was told to perform the following instructions, which I did, line for line. The part about closing Server.app seems a given, but I'm not sure why they want you to open Server.app at the the end (maybe taken out of context from some other instructions?). I did it anyway, but you should be able to begin testing, on a client workstation, right after rekerberizing is complete. I did, however, need to reboot my client, login as local admin, and then binding would proceed, and network users are able to login again. The engineer also let me know to expect an error, something like the following: "2015-03-11 21:58:38 +0000 Error synchronizing removal of attribute draft-krbPrincipalACL from record 72519e4c-7ac7-15e4-bd42-10adb1944cbc: 77013 result: 16 No such attribute" - this is apparently normal, and did in fact happen in my experience.
So here's the fix:
- Quit Server.app (don’t just close the window)
- On the Open Directory Server, execute these Terminal commands:
- sudo mkdir /var/db/openldap/migration/
- sudo touch /var/db/openldap/migration/.rekerberize
- sudo slapconfig -firstboot
- Open Server.app
And that's it. I did nothing else on my OD server, just logged out. Immediately tried binding on my MacBook client, it failed, I rebooted, tried again, it worked quickly, and I'm able to login with network user accounts again.

Can't login on iMac to Local Network accounts on server

I'm a volunteer at the Marjorie P Lee retirement community. We had two iMacs that were available for residents to use. We recently bought two more iMacs and a Mac Mini Server. The goal is to make it possible for residents to use any of the computers and have their files available.
I have set up the server and did the updates so the machine is running 10.9.4 and the latest update of the server software. I have enabled Open Directory and created a couple of Local Network User accounts for testing. I also enabled file sharing and Time Machine backups.
One of our older iMacs is running OS X 10.6.8. On this iMac, I went to the Users & Groups pane and under Login Options I connected to the Network Account Server. I got the green dot indicating that the connection was successful. I then enabled network logins. This worked; I am now able to login on this iMac to the local network accounts on the server.
I did exactly the same thing on one of our brand new iMacs. Again I got the green dot indicating a successful connection to the server. Unfortunately I have been unable to login to the local network accounts from this machine. When I try to login, the password shakes as though I had entered the wrong password.
What do I need to do to fix this?
Thanks for any help you can provide.
~~Dan

Most likely your Imac is using g or n to broadcast wirelessly while your router is using b. Solution update your router.
Greetings from Northern Ontario, Canada

Can't login after Mountain Lion upgrade (Network accounts are unavailable)

I performed a Mountain Lion upgrade on a 2011 MBP running Lion this weekend. The Mac may have been set up to connect to an AD server with my user account, but I thought I had disabled that months ago... aparently not. I performed the upgrade at home not on the corporate network.
On first bootup after the Mountain Lion upgrade I'm stuck at the login screen unable to login with my local account or the admin account. I get the "red dot" next to the username field with the "Network accounts are unavailable" pop up. I'm plugged in to the ethernet network at work now... no luck.
I tried booting into the repair disk and repairing disk permissions. Still no luck.
Any ideas? I'd happily do a fresh install but I need to get a handful of files off the machine first.

No worries with the basic questions... it's important to cover all the bases. Thanks so much for the input.
- I'm trying to log in with the same username I would use to ssh in... so yes.
- I don't know if the account was a mobile account. The Mac was given to me configured about a year ago, configured to be on the domain. I since have used it on and off many networks without considering it was set up to be on a domain.
- Never had a problem logging into the machine before the mountain lion install, although to be honest it was very very rarely ever rebooted.
- I've plugged it into ethernet and let it sit for quite some time. It's still telling me Network accounts are unavailable and I'm unable to login with my personal or admin account.

Can't always see network accounts at login screen

I just got a Mac Mini Server for my home network. This is my first time setting up an account server and first time using OS X Server. My server is running Lion, my client is running ML.
I have network accounts setup on the server and working. The home directories are on the server. I don't seem to have any issues, other than making the network accounts (I only have 4) show up on my client login screen. In other words, if I use "Other" to type in my login information, I can login just fine. I have enabled the "show network accounts" feature on my client.
Interestingly, if I am logged in via any user on the client (network or local), using fast user switching to go to the login screen ALWAYS shows the network users. Only on boot, or when all users are logged out, do I have this problem of the network accounts not showing up. Even then, they do occasionally show up.
Is there a known bug here? I've gone through several tutorials, it seems I've done all that is required.
-Ryan

I seem to have isolated the issue.
I was using wireless for both server and client, so I switched both to ethernet to eliminate any possible issues there. No change.
Then after some more experimenting I realized my original statement
if I am logged in via any user on the client (network or local), using fast user switching to go to the login screen ALWAYS shows the network users.
was incorrect. It turns out I have to be logged in with a local user for the network users to show up. So I went back and experimented with the Login Window options I configured in Profile Manager. Here is how I had my client configured.
If I enable "Show computer's administrators", or if I disabled "Show local users", the problem goes away. The problem only exists when I have one or the other, but not both, options enabled. So it seems there is a bug on the client, or there is a bug in the profile that Profile Manager is pushing to the client.
Another interesting tid bit. I temporarily changed the local user on the client to an administrator. That left the client with two administrators and no standard users. The problem went away. Turning that user back into a standard user, and the problem came back.
So there's one combination of options here that isn't working. In the long run I won't have any local users anyway, so it won't matter. This only affects me now while I'm migrating things.

Cant login multiple network accounts on the same client?

Setup:
I have created a simple Lion Server on a new i7 Mac Mini. I have configured Open Directory in Master mode and have setup 4 user accounts. I have enabled the File Sharing service and checked the "Make available for home directories" option on the "Users" file share. I have configured each of the 4 user accounts to use this location as the home folder. I have connected my client machines (all OSX Lion) to the Network Account Server.
Problem:
I can log one user into the client machine, but when using "Fast User Switching" and logging on as the second user I get the following error:
"You are unable to log in to the user account "guestaccount" at this time. Loggin to the account failed because an error occured"
In the console if I search for that user account the related error message is:
11-07-31 12:30:54.993 PM authorizationhost: ERROR | -[HomeDirMounter mountNetworkHomeWithURL:attributes:dirPath:username:] | PremountHomeDirectoryWithAuthentication( url=afp://inntaserver01.local/Users, homedir=/Network/Servers/inntaserver01.local/Users/guestaccount, name=guestaccount ) returned 16
Any thoughts as to why the Home Folder "mounter" failed in this scenario?

Historically you have never been allowed to use Fast User Switching to log in multiple network logins on the same client machine. This certainly applied with Tiger, Leopard, and Snow Leopard. I have not yet personally tried this with Lion.
I believe that the underlying reason for this not being allowed is down to how AFP volumes are mounted. The AFP mount becomes 'owned' by the user that triggers the login. With a network login the first user becomes the owner and this means subsequent attempted network logins are denied access to that share and hence cannot access their home directories.
With Tiger, Leopard, and Snow Leopard servers, one could configure network home directories to be shared via NFS instead of AFP. NFS gets treated a lot different in terms of mounting, and is done more at a system level than a user level. While again I have not personally tried Fast User Switching with NFS shared home directories, this approach is specifically recommended by the authors of AquaConnect (a Macintosh Terminal Server solution) in order to allow multiple logins on the same Terminal Server. This seems to be for the same underlying reason. Using NFS does certainly work for use with AquaConnect and also works for the competing iRAPP Terminal Server product as well.
Unfortunately, Lion Server while it can be made to run an NFS server, will not let you configure using NFS for sharing home directories. I have actually reported this as a 'bug' in Lion server.
Neither the authors of AquaConnect or iRAPP have actually tested this scenario with Lion server yet, but AquaConnect do plan to investigate it. It could make it considerably more difficult to use their products.
So in summary, using NFS to share network home directories in theory would avoid the problem and can be done with a Tiger/Leopard/Snow Leopard server, but cannot be done with a Lion server. It is possible however to mix Lion with older server versions. This might for some people be a possible workaround.
PS. A bonus side-effect of using NFS shared home directories was that this allowed badly written software like Adobe's applications which are otherwise notorious for having major issues with network logins and home directories to work without errors. As an example Adobe Acrobat Pro introduced a bug in version 7.0 which prevented it being able to print-to-PDF (one of the major reasons to buy Acrobat Pro). It tooks two years for them to eventually fix this in Acrobat Pro 8.1 (I know because I spent that two years nagging them to fix it and was a beta tester). Unfortunately they then reintroduced the bug in Acrobat Pro 9.0. Fortunately I discovered this side-effect got round the issue although a clunkier workaround was also possible for Snow Leopard clients by redirecting certain folder paths.

Login with a network account in offline, possible?

Hello,
I have a question, since I had before snow leopard server. So the questions now belongs to the Lion Server, the dedicated server. And this is not a issue, but few questions to you and need to plan to setup to the dedicated server if there is a or few way to do!
Before I could login in with a network account from Snow Leopard server from my MacBook PRO. I think there is still possible to do it. But now today I just wonder is there a possible to login in with a network account in offline too, also no internet require? And what is the name for that? True, I don't know a lot of VPN and never used this, can you explain bit about it? But I know when I logged in, I used a Open Directory account and this was "virtual screen", no need to open the screen sharing program or whatever. It just was from the Login Window, also when you are turn on the computer. Do you know what name and know how to could use a network account in offline on my mac?
I just want to give you an example:
If I am sitting in a flight to Vancouver from London, then there I have no internet access in flight trip, so I just login the network account and this had before "cache". Of course need to login in internet first to get all informations and files in computer, so these are stored in my computer. Then I am working with a presentation during the trip. When I am arrived in Vancouver, then I am connecting to a internet, so the computer, also the network account will update to the server with these new files etc or of these what I did in during the flight trip.
Here is few question sticks from the text above:
1. Can I use a network account in offline?
2. Do you know any name for this method in Mac?
3. I don't know VPN, so what do this mean and containing what?

Hi
"1. Can I use a network account in offline?"
If I've understood you correctly, yes.
"2. Do you know any name for this method in Mac?"
There are several: Portable Home Directories, Mobility, Mobile Accounts etc:
http://manuals.info.apple.com/en_US/UserMgmt_v10.6.pdf
Page 215 onwards. Additionally Page 163 if Active Directory is involved.
"3. I don't know VPN, so what do this mean and containing what?"
You could have googled this yourself but here you go:
http://www.howstuffworks.com/vpn.htm
Essentially it's a means of providing a secure connection from remote networks such as your home or possibly a hotel to a specific location - such as your office or place of work - which allows you to access Servers and/or Services as if you were at that location itself.
". . . so the computer, also the network account will update to the server with these new files etc or of these what I did in during the flight trip."
Depending on where you are and the size of the files this may be a doutftul/painful experience and possibly not worth undertaking? However only you would really know? IMO it would make more sense to sync these files once you were back on the Server's network. It's possible you may benefit by signing up for MobileMe or iCloud?
HTH?
Tony

LDAP Authentication "Network Accounts Unavailable" on 10.8

Hello,
We've been successfully authenticating against our LDAP servers on our 10.6.8 machines without any problems. I've setup a test machine running 10.8 to see if we will have any issues when it comes time to upgrade our lab OSs. I setup our LDAP authentication on the machine as per our usual methods. I get the "Green Light" in the Users/Groups preferences pane that our LDAP server is found. I can search through our LDAP users in the Directory Editor and I can access LDAP user accounts through terminal.
My problem is at the login screen it tells me "Network Accounts Unavailable". This seems contradictory as when I'm logged into a local account, I can access our LDAP server. It seems to work everywhere except at the login screen.
I've tried this openLDAP fix: http://iwatts.blogspot.ca/2012/01/osx-1072-openldap-authentication.html
No luck.
Any ideas?

I see the same problem as a result of having the same UID number for both my local account and my LDAP account although the account names are different. It appears that upon providing the correct login/password to the LDAP server, 10.8 looks at the returned UID , identifies it as the same as a local UID and then rejects the login.
A security measure I want to work around but perhaps there is a better way of accessing both my local and LDAP accounts but keeping it as easy as it would be if both accounts had the same UID.

Cannot login with Network account.

Hi,
I am an experimented Mac user, but quite new with Snow Leopard Server.
I've just purchased the brand new MacMini Server.
I have configured my server with the name server.local and installed OpenDirectory as Master.
I wanted to try the network login, so I created a Test1 account in Open Directory. Then from my iMac I joined my server.local through System Preferences/Accounts/Options/... then I log off and try to use the newly created account test1.... I asked the system to change the password from first loggin... which works, but then I receive a message saying that I cannot log in for the moment... I tried everything but I just can't use the network account.
Any hints?
Cheers.

You should avoid .local at all costs when configuring an OS X Server.
.local is reserved for zeroconfig/Bonjour, and will cause conflicts.
There's an excellent tutorial for new users here
http://www.wazmac.com/serversnetwork/fileservers/osxserver_setup/osxserver106setup.htm
Jeff

Cannot login to network account (leopard client and server)

Up until now, I have used local accounts on my leopard server. I want to start experimenting with OD prior to implementing. I created a new user account in the /LDAPv3/127.0.0.1 domain, and have bound my leopard client to the server using directory utility. On the login screen, "Network Accounts Available" has a green button to the left of it. When I try and login to the server account, the login window just shakes. At first, I could enter the password and then it would prompt me for a new password. Trying to enter a new password would not allow me to login. I went back to server admin and disabled the "require new password" setting, (as well as the other good security policies)...
I have also reset the password in WGM, and made sure to disable all the security stuff there too...
Lastly, I have deleted the server in directory utility, rebooted, then added it back in, and rebooted again...
I still cannot login to the server account, the login screen just shakes
Does anyone have an idea of what settings and or logs I can check to try and narrow down what is going on?
Thanks in advance....

to close out the thread, I have working dns on my network, but I did not have dns enabled on my server. I enabled the dns service and entered just the info for my server, then assigned my server and client to use the server's ip addy as the primary dns server. Next, I created the home directory.
Once both steps were done, I was able to log in from my client to my server based account...
FYI-I found a document on afp548.com called "leopard server: advanced setup, rsync backup and automated reporting" that walks you right thru the process...Here is the link, it's a very useful doc....
http://www.afp548.com/filemgmt_data/files/Leopard%20Server%20Quickstart%20Guide. pdf
thanks again boomboom_uk and woVi, your suggestions were spot on....

ApacheDS (LDAP) Network Accounts Never Can Login

Similar Messages

Maybe you are looking for